Detection rules › Sublime MQL

Sublime MQL rules: invoicera

Rule	Severity
Invoicera infrastructure abuse	`medium`

Invoicera infrastructure abuse

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

This rule is tailored to flag infrastructural abuse involving Invoicera, a SaaS-based invoicing and billing platform, which has been identified as a tool in widespread spam and credential phishing campaigns.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing, Spam
Tactics and techniques	Free file host, Free subdomain host, Image as content, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.links
headers
headers.return_path
recipients
recipients.to
sender.email
type

Rule body

type.inbound
and sender.email.domain.root_domain == "invoicera.com"
// suspicious recipient pattern
and (
  length(recipients.to) == 0
  or any(recipients.to, .email.domain.valid == false)
  or length(recipients.bcc) > 0
)
// suspicious link
and (
  any(body.links,
      .href_url.domain.root_domain in $free_file_hosts
      or .href_url.domain.domain in $free_file_hosts
  )
  or any(body.links,
         .href_url.domain.root_domain in $free_subdomain_hosts
         and .href_url.domain.subdomain is not null
         and .href_url.domain.subdomain != "www"
  )
)
// mismatched reply-to
and (
  headers.return_path.email is not null
  and headers.return_path.email != sender.email.email
)

Detection logic

Scope: inbound message.

inbound message
sender.email.domain.root_domain is 'invoicera.com'
any of:
- length(recipients.to) is 0
- any of recipients.to where:
  - .email.domain.valid is False
- length(recipients.bcc) > 0
any of:
- any of body.links where any holds:
  - .href_url.domain.root_domain in $free_file_hosts
  - .href_url.domain.domain in $free_file_hosts
- any of body.links where all hold:
  - .href_url.domain.root_domain in $free_subdomain_hosts
  - .href_url.domain.subdomain is set
  - .href_url.domain.subdomain is not 'www'
all of:
- headers.return_path.email is set
- headers.return_path.email is not sender.email.email

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, headers.return_path.email, recipients.bcc, recipients.to, recipients.to[].email.domain.valid, sender.email.domain.root_domain, sender.email.email, type.inbound. Reference lists: $free_file_hosts, $free_subdomain_hosts.

Indicators matched (1)

Field	Match	Value
`sender.email.domain.root_domain`	equals	`invoicera.com`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(body.links)
      and
        body.links.href_url.domain.subdomain is_not_null
        body.links.href_url.domain.subdomain ne "www"
         macro "body.links[].href_url.domain.root_domain in free_subdomain_hosts"
    any(body.links)
      or
         macro "body.links[].href_url.domain.domain in free_file_hosts"
         macro "body.links[].href_url.domain.root_domain in free_file_hosts"
  or
    any(recipients.to)
      recipients.to.email.domain.valid eq "false"
    recipients.bcc length_compare "0"
    recipients.to length_compare "0"
  headers.return_path.email cross_field_compare "sender.email.email"
  headers.return_path.email is_not_null
  sender.email.domain.root_domain eq "invoicera.com"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`headers.return_path.email`	cross_field_compare	`sender.email.email` transforms: `op:ne`	`field:"headers.return_path.email" kind:cross_field_compare value:"sender.email.email"`
`headers.return_path.email`	is_not_null	(no value, null check)	`field:"headers.return_path.email" kind:is_not_null`
`sender.email.domain.root_domain`	eq	`invoicera.com`	`field:"sender.email.domain.root_domain" kind:eq value:"invoicera.com"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`